In order to defend against threats to networks and other information technology (IT) infrastructure in the field, telemetry and other indicators of potentially malicious behavior can be collected from various sources and analyzed. By gleaning information concerning events that signify anomalous behavior from a wide range of sites, ongoing attacks can be detected and future attacks can be blocked proactively.
IT administrators of large enterprises could also benefit greatly from sharing intelligence regarding security best practices. For example, many intrusion detection systems (IDS) are constantly updated by experienced IT administrators with new rules capable of catching or defending against new types of threats. Collecting information concerning effective security best practices (so-called “positive telemetry”) could provide a valuable resource for IT administrators, especially when shared among organizations in the same industry. However, organizations are reluctant to openly share/expose information regarding specific attacks directed against their infrastructure. Where organizations do not share such information concerning their own successful practices, IT administrators at other organizations have to “re-invent the wheel.”
It would be desirable to address these issues.